{"cve":"CVE-2026-54906","nvd":{"published":"2026-06-24T17:17:29.550","modified":"2026-10-25T22:10:00.150","status":"Analyzed","description":"concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":2.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-414","CWE-667"],"references":["https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr","https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr"],"products":["rubyconcurrency:concurrent_ruby"],"source":"nvd","synced_at":"2026-10-25T23:44:33.281319194+00:00"},"epss":{"cve":"CVE-2026-54906","score":0.0016,"percentile":0.05177,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-6wx8-w4f5-wwcr","url":"https://osv.dev/vulnerability/GHSA-6wx8-w4f5-wwcr","summary":"Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption","modified":"2026-09-10T03:50:48.681965743Z","packages":[{"ecosystem":"RubyGems","name":"concurrent-ruby","purl":"pkg:gem/concurrent-ruby","ranges":["<1.3.7"],"fixed":["1.3.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}